ConnectWise breached in cyberattack linked to nation-state hackers

ConnectWise reported suspicious activity it believes was tied to a sophisticated nation-state actor that impacted a very small number of cloud-hosted ScreenConnect customers; the company engaged Mandiant, coordinated with law enforcement, implemented enhanced monitoring and mitigations, and patched a high-severity ASP.NET ViewState deserialization vulnerability (CVE-2025-3935) that could allow remote code execution, though details on exploitation, affected customers, and IOCs remain scarce.